Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <a56094b0-2af9-209f-780a-b5626560800c@fb.com>
Date:   Mon, 19 Sep 2022 21:21:01 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.2.2
Subject: Re: [PATCH v17 11/12] selftests/bpf: Add test for
 bpf_verify_pkcs7_signature() kfunc
Content-Language: en-US
To:     KP Singh <kpsingh@kernel.org>,
        Roberto Sassu <roberto.sassu@huaweicloud.com>
Cc:     ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
        martin.lau@linux.dev, song@kernel.org, john.fastabend@gmail.com,
        sdf@google.com, haoluo@google.com, jolsa@kernel.org,
        mykolal@fb.com, dhowells@redhat.com, jarkko@kernel.org,
        rostedt@goodmis.org, mingo@redhat.com, paul@paul-moore.com,
        jmorris@namei.org, serge@hallyn.com, shuah@kernel.org,
        bpf@vger.kernel.org, keyrings@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org,
        deso@posteo.net, memxor@gmail.com,
        Roberto Sassu <roberto.sassu@huawei.com>,
        Joanne Koong <joannelkoong@gmail.com>
References: <20220909120736.1027040-1-roberto.sassu@huaweicloud.com>
 <20220909120736.1027040-12-roberto.sassu@huaweicloud.com>
 <CACYkzJ7uraUdmGV9gMmTZs1OMb_3Q2DttoaxU-irmrXFudOweQ@mail.gmail.com>
From:   Yonghong Song <yhs@fb.com>
In-Reply-To: <CACYkzJ7uraUdmGV9gMmTZs1OMb_3Q2DttoaxU-irmrXFudOweQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?blJIR2E4cnRlS2FzVzJLdGdzVXIwOG16bE5yblpETFdkbFRKam4zU0I2VlJw?=
 =?utf-8?B?RnhKUnV2YUNmWnRuYVdCc3k4dVZkRjZaRHc4Sk1kWGlCc2J4WlFyKzJuRk0r?=
 =?utf-8?B?Y2FFUWk0ZVVvMmMzSDV5UHc4a0dEQ2hCU1pqWDBITmdNSHJvZ3ZObVVyK1dI?=
 =?utf-8?B?eCtvdW4wVmJ4QkF0VGFzbWRiSjd1aUJFbHRBTGkxTWhzSlJQS0ppT3dQdzFt?=
 =?utf-8?B?QlFOa2FzVkE0bkhqZFlWYmhBekRxQUNQd1ZDR3Y4amxjSktTU1A3ZXF6bSt5?=
 =?utf-8?B?YUx1M0tKNEs5dmRLZjJrcWFWTUJHSkNPcG9yMDBNWC9WY2RjVjIweVh5Rkps?=
 =?utf-8?B?VURYTlAxbjdWQTFLcm1kc3pweFVURmNWaHhhbjNONVhTMG1LNk5MT2tEWkph?=
 =?utf-8?B?UFRkNU9mNDduS3p3c0l5UnBhQThLOHA3WS84ZFlSNlZXVk1SckNiNTZXMTQ5?=
 =?utf-8?B?NGhRbUNDMUdIbWVNeXJSYnBNdXhTTVFsWGw5SkY1WDMrUFBHK3hUQk9RYm53?=
 =?utf-8?B?WmNIaFVLK2dmTWdzcHhuM2RSdnk3RytRTzhjelZBaWFoL1pVMEtLSHBlbktw?=
 =?utf-8?B?QmdzeGQ0MzFpQnAyc2J0clFQNzd5dEVHNHJsMDkzUHFXRENoSzhaTmpoK2hY?=
 =?utf-8?B?YjBsQ3V3SDB3RFlvV3NpUGxUekZhWkhUV3hXZVJHQzBzazBNUmE3MG90eWFy?=
 =?utf-8?B?bUFHWHFrU0xoOVdqZjZyUjdQZGNnZXp1K2pnNHJYeWZ1aHd3RGNTMFcrcEV2?=
 =?utf-8?B?SjRzSWZkcFRtQWF5QVBUYmRvY0d1V1RrdHF0M2tRa2VXb05HR0pGTWZCbVkr?=
 =?utf-8?B?UzV0NjVFYVp6cW5POTlBVE44ZXlvWXVKY25naTh4MjhMaU42VE5IMWVLQkE1?=
 =?utf-8?B?ZjRib2dJUXNTOHM5aC96UENSYVFqVURCOG40WVZnMXd0UTU3ZlE2MUs0cGZj?=
 =?utf-8?B?UnJOVDZZTCs0aFRXeXZIRWpwdzNQM28vN0VrU0IwVGNmWVJ6bnVldFZ0UGJa?=
 =?utf-8?B?SnNJR3p6UHNNd3hEWXpkRlhNL2xjYVVFM3ZRL2RYbUQxekVWWS9naFh1QS9u?=
 =?utf-8?B?RHgwWjZtbndEK2pDRXBBRVIwTkVUQm1hWTNKSXdDblNFTVc2azdtVHoyc05w?=
 =?utf-8?B?UE41R01WcHNJZnVXZFdKVGs5TjhEcFdGakFQb1Z0Yjl1Nk81NFZGZXlQSGVy?=
 =?utf-8?B?UTJBUkg1cXorRFFoV0dPdGVFTlJZTFdKM0lKblR1YmNKQkIrNE95WE5uWmFk?=
 =?utf-8?B?a2E3ejdOM1REMk5xZmNsVkVqTUR4TUszbldja0UvbEUvMHBxWXNmRHZkMlpX?=
 =?utf-8?B?YmZ6TW9vUUZrMjdPTGIxdDUrMVpPSDVSUzB1N1l2UDlSb1FId2tOMnVFeTR2?=
 =?utf-8?B?Qi9SU3cvbFZvaXJkbmdSQVQxYUplWjluaWVIVmVDdDl2Z0k1NzVmZExDVjRD?=
 =?utf-8?B?RjdtMmxBNlpTeUZrcU1hbEkwQ28rM04xNFBKZXhoL2RObm5Cczh0Y0hBWTZU?=
 =?utf-8?B?UldjN0IvTVlwOEY5QWpSbHNJY1pndUdvRS9XMnpIV096ZUViYTBxZ2kwTkto?=
 =?utf-8?B?blhydXJtbWxCaU1namlScE1qU2gyWjVlQlBucHhqVlNTdWhOMG8wU001MldG?=
 =?utf-8?B?cTUzTUVlNGhxc3hhN2tONHVtcCsrRWFlMnlvb3QrKzBzQ2NRbU40QmZKT2Fv?=
 =?utf-8?B?VHVQMWNVRDFsbC8wVkUyU0ppSzZkTlVLN2NPNXFkaVAwdk1kN2RFYXVHd2hN?=
 =?utf-8?B?Q2htSlg4bmZ3Y0ZHUWJMS0FMREVEekphNURtQUxDamFpQkxHcjk3Y0hQL1ZT?=
 =?utf-8?B?dHRwMGF5YWZWLzNYbk95cFV1SXNQSGJxb2M1R0FGcVhlZGNWTTI4TUQ4azhm?=
 =?utf-8?B?WFZObGh2VlNFS3VBOHhlMTIrWmduUllYNWhkQVlxQmg3REJaMmN3WTRvaFRk?=
 =?utf-8?B?eE9IU3kyWXQrUzZWU0NHYSsvZVpweXNxOHZsM3NXaGZBTk9HVVE5U2VENEpl?=
 =?utf-8?B?czlwYVF3UERrYnYxbkRwU2Fqd3pSVnNuRVhESXQ4cHRRRjlhMi9MeE9FRmRM?=
 =?utf-8?B?MjN6UVcvM042VVBRYXVvQjdoUW1BcCtiekowb043R0dSQUJOaGllczRPcUU2?=
 =?utf-8?B?d1dXcUt3ZEI2a1BJWGJhZ1lKTDY1SVRYaTMrUnA4K1ltRFdpKzdGK0JIdXdP?=
 =?utf-8?B?OEE9PQ==?=
X-OriginatorOrg: fb.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ce39d8a7-48f9-4019-64d7-08da9abf8a23
X-MS-Exchange-CrossTenant-AuthSource: SN6PR1501MB2064.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2022 04:21:07.4446
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gvitBkQi4OruaOqKDVDcxjIxgla/GkrkGYFuzf7LvtfH2EUwForEffnSHdqQqbTf
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR15MB4888
X-Proofpoint-ORIG-GUID: lzVjoBNWhYwhpdDX6ZJY9vxYlMtVixXE
X-Proofpoint-GUID: lzVjoBNWhYwhpdDX6ZJY9vxYlMtVixXE
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-19_13,2022-09-16_01,2022-06-22_01
X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,
        SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 9/15/22 9:11 AM, KP Singh wrote:
> On Fri, Sep 9, 2022 at 1:10 PM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
>>
>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>
> 
> [...]
> 
>> +}
>> diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
>> new file mode 100644
>> index 000000000000..4ceab545d99a
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
>> @@ -0,0 +1,100 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +
>> +/*
>> + * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
>> + *
>> + * Author: Roberto Sassu <roberto.sassu@huawei.com>
>> + */
>> +
>> +#include "vmlinux.h"
>> +#include <errno.h>
>> +#include <bpf/bpf_helpers.h>
>> +#include <bpf/bpf_tracing.h>
>> +
>> +#define MAX_DATA_SIZE (1024 * 1024)
>> +#define MAX_SIG_SIZE 1024
>> +
>> +typedef __u8 u8;
>> +typedef __u16 u16;
>> +typedef __u32 u32;
>> +typedef __u64 u64;
> 
> I think you can avoid this and just use u32 and u64 directly.

For consistency of typical bpf programs and bpf.h, using __u{8,16,32,64}
should be okay.

> 
>> +
>> +struct bpf_dynptr {
>> +       __u64 :64;
>> +       __u64 :64;
>> +} __attribute__((aligned(8)));
>> +
> 
> I think you are doing this because including the uapi headers causes
> type conflicts.
> This does happen quite often. What do other folks think about doing
> something like
> 
> #define DYNPTR(x) ((void *)x)
> 
> It seems like this will be an issue anytime we use the helpers with
> vmlinux.h and users
> will always have to define this type in their tests.

We can use BTF_TYPE_EMIT macro to emit bpf_dynptr type to vmlinux dwarf 
and then to vmlinux BTF and vmlinux.h. For example, with below change,

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 41aeaf3862ec..bbdc53fec625 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1400,6 +1400,7 @@ static const struct bpf_func_proto 
bpf_kptr_xchg_proto = {

  static bool bpf_dynptr_is_rdonly(struct bpf_dynptr_kern *ptr)
  {
+       BTF_TYPE_EMIT(struct bpf_dynptr);
         return ptr->size & DYNPTR_RDONLY_BIT;
  }

in vmlinux.h, we will have

struct bpf_dynptr {
         long: 64;
         long: 64;};

> 
> - KP
> 
>> +extern struct bpf_key *bpf_lookup_user_key(__u32 serial, __u64 flags) __ksym;
>> +extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
>> +extern void bpf_key_put(struct bpf_key *key) __ksym;
>> +extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
>> +                                     struct bpf_dynptr *sig_ptr,
>> +                                     struct bpf_key *trusted_keyring) __ksym;
>> +
>> +u32 monitored_pid;
>> +u32 user_keyring_serial;
>> +u64 system_keyring_id;
>> +
>> +struct data {
>> +       u8 data[MAX_DATA_SIZE];
>> +       u32 data_len;
>> +       u8 sig[MAX_SIG_SIZE];
>> +       u32 sig_len;
>> +};
>> +
>> +struct {
>> +       __uint(type, BPF_MAP_TYPE_ARRAY);
>> +       __uint(max_entries, 1);
>> +       __type(key, __u32);
>> +       __type(value, struct data);
>> +} data_input SEC(".maps");
>> +
>> +char _license[] SEC("license") = "GPL";
>> +
>> +SEC("lsm.s/bpf")
>> +int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
>> +{
>> +       struct bpf_dynptr data_ptr, sig_ptr;
>> +       struct data *data_val;
>> +       struct bpf_key *trusted_keyring;
>> +       u32 pid;
>> +       u64 value;
>> +       int ret, zero = 0;
>> +
>> +       pid = bpf_get_current_pid_tgid() >> 32;
>> +       if (pid != monitored_pid)
>> +               return 0;
>> +
>> +       data_val = bpf_map_lookup_elem(&data_input, &zero);
>> +       if (!data_val)
>> +               return 0;
>> +
>> +       bpf_probe_read(&value, sizeof(value), &attr->value);
>> +
>> +       bpf_copy_from_user(data_val, sizeof(struct data),
>>
> 
> [...]
> 
>> --
>> 2.25.1
>>